What happens when a security researcher downloads iOS app from the App Store and starts pulling it apart?
In this live session, you'll find out — no slides, no theory, no mercy.
**I'll take a real iOS application, download it, and perform a full static security analysis live** **— step by step, using professional-grade tools.** You'll watch as hardcoded secrets, insecure data storage, weak encryption, and exposed API endpoints surface in minutes.
Then, for a bonus round, we'll take a quick look at a banking app from the wild to see how the same mistakes show up in financial software handling real money.

**What you'll walk away with:** — How attackers reverse-engineer iOS binaries — The most common security mistakes in production apps — What static analysis actually looks like in practice — Why "it's on the App Store, so it's safe" is a dangerous myth

**Who this is for:** iOS developers, security engineers, tech leads, and anyone responsible for the security of mobile applications.

**About the host:** Sergii Koval — 15+ years in iOS/macOS security. Security architect for banking and enterprise platforms. Creator of Threat Explorer, a proprietary iOS security analysis platform. Based in Luxembourg.

**Format:** Live demo via Google Meet. \~60 minutes. Free. Recorded for YouTube.
This is part of a monthly series. Each session, a different app goes on the table.

Luxembourg Vibe-Code & Hack Apps

Sèrge Koval

Savvas Stampolloglou

Fabio Lanciotti

Analu brondino

Krystian Wytrzymaly

Narina

Sanket Pimplé

Jenny

sib.kruse

Zakaria Belkacem

Stefan Ilic

Romaric GBADA

Ridvan Kotan

Sipos Péter

Antariksh Patre

whyalwaysme1314

Sivakumar U

Nuno Edgar Nunoedgarfernandes

iOS App Autopsy #1: Banking/FinTech — What Your App Binary Reveals to Attackers

Online event

Most apps don’t fail because of code — they fail because they don’t **make money**.
In this live, hands-on session, we’ll build a real iOS app from scratch using AI-assisted (vibe) coding — and **integrate monetization** from the very beginning.

No theory. Just a **real app, built step by step**.

You’ll see:

* how to go from idea to **working app** in under an hour
* how to structure a simple product that can actually **generate revenue**
* how **subscription models** work in practice (weekly, monthly, yearly)
* what makes a **paywall convert** — and what kills it
* how tools like **[Adapty's Discord](https://discord.gg/VFVQ2MBTR9)** help you
* **paywall experiments** without rebuilding your app

This session is designed not only for developers, but also for **vibe coders, indie makers, and founders** who use AI tools to build products faster — even without a deep technical background.

**What you’ll walk away with**

* a clear understanding of how monetization fits into product design
* a real example of a working app with a paywall
* practical insights you can apply immediately

**Format**

* Live coding session (\~60 min)
* Short discussion & Q&A

**Who should attend**

* mobile developers
* vibe coders & AI builders
* indie makers
* startup founders

**About the host**
Sèrge Koval — iOS/macOS engineer with 17+ years of experience, cybersecurity specialist, and organizer of Luxembourg Vibe Coding workshops.

**Stay in touch**
After the session, I’ll share a few extra tips, resources, and updates here:
[https://discord.gg/VFVQ2MBTR9](https://discord.gg/VFVQ2MBTR9)

**Notes**
The session will be conducted in English.

📍 OFFLINE and ONLINE from Luxembourg City
🗓 May 27\, 2026 \| 18:00–19:30
⚡️Spots are limited to 200 — register now.

sophie.leiyixiao

Suprasanna Sarkar

Alexandra Macskasy

Richard

Mehmet Arslan

ichrak

Hanan 

koushik

Nikki Hayhoe

Rufus Mall

Omar Miah

Bowen

Andi Ryugeist

abou99567

Eugene

Vibe Coding: Build & Monetize an iOS App in 60 Minutes

Silversquare Luxembourg

What happens when a security researcher downloads a health app from the App Store and starts pulling it apart? In this live session, you'll find out — no slides, no theory, no mercy.
I'll take a real healthcare iOS application, download it, and perform a full static security analysis live — step by step, using professional-grade tools. You'll watch as unencrypted databases with patient information, Firebase configurations leaking backend data, hardcoded API keys, and user profiles stored in plain text surface in minutes. Then, for a bonus round, we'll examine how a well-known health or fitness app handles your medical data behind the scenes.

**What you'll walk away with:** — How health apps store your most sensitive data (and how poorly they protect it) — What Firebase misconfigurations actually expose in practice — Why local databases on your device are rarely as encrypted as you'd expect — How attackers move from a single leaked config file to full backend access.

**Who this is for:** iOS developers working with health data, product managers in MedTech, security engineers, and anyone building apps that handle personal or medical information.

**About the host:** Sergii Koval — 15+ years in iOS/macOS security. Security architect for banking and enterprise platforms. Creator of Threat Explorer, a proprietary iOS security analysis platform. Based in Luxembourg.

**Format:** Live demo via Google Meet. \~60 minutes. Free. Recorded for YouTube. This is part of a monthly series. Each session, a different industry goes on the table.

isa_bella

Josef

Amir KC

Mahmoud

Gabriel Alonso

ahmed2sabry125

Dirk Maat

Hannah

Aaron 

iOS App Autopsy #2: Your Health Data Is Not as Private as You Think — MedTech

What happens when a security researcher downloads a government app from the App Store and starts pulling it apart? In this live session, you'll find out — no slides, no theory, no mercy.
I'll take a real government or public-sector iOS application — digital ID, tax portal, public transport, municipal services — download it, and perform a full static security analysis live. You'll watch as exposed server endpoints, weak transport security configurations, unprotected API routes, and sensitive URLs embedded in the binary surface in minutes. Then, for a bonus round, we'll look at how network traffic from a government app behaves when someone is listening.

**What you'll walk away with:** — How government apps construct and expose their network requests — What a man-in-the-middle interception actually reveals in practice — Why the largest user base combined with the slowest update cycle is a security problem — How hardcoded server configurations become an attacker's roadmap.

**Who this is for:** developers in the public sector, civic tech practitioners, security professionals, and anyone who uses government apps daily and would prefer to know what's going on under the bonnet.

**About the host:** Sergii Koval — 15+ years in iOS/macOS security. Security architect for banking and enterprise platforms. Creator of Threat Explorer, a proprietary iOS security analysis platform. Based in Luxembourg.

**Format:** Live demo via Google Meet. \~60 minutes. Free. Recorded for YouTube. This is part of a monthly series. Each session, a different industry goes on the table.

Layla

egorov.vladlen

Niranchan Punniaseelan

iOS App Autopsy #3: What Government Apps Know About You (And Poorly Guard It)

What happens when a security researcher downloads a dating app, a fitness tracker, or a food delivery app from the App Store and starts pulling it apart? In this live session, you'll find out — no slides, no theory, no mercy.
I'll take a real social or lifestyle iOS application, download it, and perform a full static security analysis live. You'll watch as graphic assets ready for phishing clones, authentication tokens left in the open, interface files that reconstruct the entire UI, and downloadable resources that can be hijacked surface in minutes. Then, for a bonus round, we'll walk through how an attacker assembles these pieces into a convincing fake app designed to steal user credentials.

**What you'll walk away with:** — How attackers build phishing clones from assets inside legitimate app binaries — What exposed authentication tokens and social media credentials look like in practice — Why your UI design files and graphic assets are a security risk, not just a design deliverable — How on-demand resources and interface files become tools for social engineering.

**Who this is for:** mobile developers, startup founders, UI/UX designers, security engineers, and anyone interested in understanding how everyday app assets get repurposed for identity theft.

**About the host:** Sergii Koval — 15+ years in iOS/macOS security. Security architect for banking and enterprise platforms. Creator of Threat Explorer, a proprietary iOS security analysis platform. Based in Luxembourg.

**Format:** Live demo via Google Meet. \~60 minutes. Free. Recorded for YouTube. This is part of a monthly series. Each session, a different industry goes on the table.

Hurol Ya

Vishwa

Enfys Luk

iOS App Autopsy #4: When Your App Knows Your Face — Cloning & Identity Theft

kovallux

グループ

{PRO_NETWORK_NAME}はMeetup Proに登録しており、世界中の{PRO_GROUP_COUNT}のMeetupで{PRO_MEMBER_COUNT}人以上のメンバーが参加しています。Meetup Proは、ユーザー、パートナー、コントリビューター、メンバーのネットワークを管理できるプロフェッショナルなコミュニケーションツールです。

kovallux

私たちについて

今後のイベント

私たちについて

グループ